Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @sigstore/verify | npm | = 3.1.0 | 3.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in how sigstore-js handles timestamps from transparency logs (tlogs). Specifically, it trusted the integratedTime field from a tlog entry as a valid timestamp source even when it was not cryptographically signed as part of an inclusionPromise. An attacker could craft a Sigstore bundle with a manipulated integratedTime and, because of this vulnerability, have it accepted as a valid timestamp. This could bypass certificate validity checks that rely on this timestamp.
The patch addresses this by modifying the getTLogTimestamp function to only return a timestamp if the tlog entry contains a verifiable inclusionPromise. Consequently, the Verifier.verifyTimestamps function was updated to handle cases where getTLogTimestamp returns no timestamp, ensuring that only cryptographically-bound timestamps are used for verification. The vulnerable functions are getTLogTimestamp for creating the unverified timestamp, and Verifier.verifyTimestamps for using it in the verification process.
getTLogTimestamppackages/verify/src/timestamp/index.ts
Verifier.verifyTimestampspackages/verify/src/verifier.ts